INSPECTOR GENERAL 
DEPARTMENT OF DEFENSE 
400 ARMY NAVY DRIVE 
ARLINGTON, VIRGINIA 22202-4704 OCT 2 6 2010 



MEMORANDUM FOR MAJOR GENERAL MARY A. LEGERE, U.S. ARMY, 

COMMANDING GENERAL, ARMY 
INTELLIGENCE AND SECURITY COMMAND, 
FORTBELVOIR, VA 

SUBJECT: Investigation under 5 U.S.C. § 2302(b)(8) 



We recently completed our investigation into allegations that Mr. James M, 
Helms, a former Intelligence Specialist at the Fort Knox field office of the 902nd 
Military Intelligence Group, received an unfavorable personnel security 
determination because of his whistleblowing activities. 

We substantiated the allegation that Agency officials reprised against 
Mr. Helms when recommending that his security clearance be revoked. We 
concluded that the Agency did not establish by clear and convincing evidence, a 
firm belief, that it would have taken the same action absent Mr. Helms' 
disclosures. Our report of investigation is attached. 

We recommend that you consider an appropriate remedy with respect to 
Mr. Helms. If you have any questions, please contact me or Mr. John Hickey, 
Acting Director, Civilian Reprisal Investigations, at (703) 604-8613. 




Deputy Inspector General for 
Administrative Investigations 

Attachment: 
As stated 



cc: Mr. James M. Helms 



INSPECTOR GENERAL 



DEPARTMENT OF DEFENSE 
400 ARMY NAVY DRIVE 
ARLINGTON, VA 22202-4704 



Ref: 11-00016-FP 
November 15,2010 



OCCL 

Mr. James M. Helms 

306 South Atcher Street, Apt #2 

Radcliff,KY 40160 , 

Dear Mr. Helms: 

This is in response to your October 26, 2010, Freedom of Information Act (FOIA) 
request seeking "the completed DoDIG, CRI investigation concerning myself, James M. 
Helms ". We received your request on October 27, 2010, and assigned it FOIA case 
number 11-00016-FP. 

Please find enclosed the document you requested. I am, however, withholding 
portions of these records under the provisions of Exemptions 6 and 7(C) of the FOIA, 
specifically, 5 U.S.C. § 552 (b)(6), which pertains to information, the release of which, 
would constitute a clearly unwarranted invasion of personal privacy and 5 U.S.C. § 
552(b)(7)(C), which pertains to information compiled for law enforcement purposes, the 
release of which could reasonably be expected to constitute an unwarranted invasion of 
the personal privacy of third parties. 

If you are not satisfied with this action, you may submit an administrative appeal to 
Mr. John R. Crane, Assistant Inspector General, Office of Communications and 
Congressional Liaison, Room 1021, 400 Army Navy Drive, Arlington, VA 22202-4704. 
Your appeal should be postmarked within 60 days of the date of this letter, should cite 
case number 1 1-00016-FP, and should be clearly marked "Freedom of Information Act 
Appeal." 



Sincerely, 




Jeanne Milled r~T^ 
Chief, Freedom of mfbrmation and 
Privacy Office 



Enclosure: 
As stated 




"The enclosecTTiocumeTrt^s^^ the property of theDejjartmcrrt^f^efe^iseToffice of 
Inspector General. Release orcnsClusuMauaf' th£_ cotrrrflTTTi prohibited by DOD Directive 
5106.1. Contents may be disclose^t-only t o^ rs i oi ^ jothose official duties require access 
hereto. Contents canno£J w » el cg seaoutside the DefenseDep^T+m«atjwithout the approval of 
the DepartjnenHrflJeTense, Office of Inspector General." " 



INSPECTOR GENERAL 
DEPARTMENT OF DEFENSE 
400 ARMY NAVY DRIVE 
ARLINGTON, VIRGINIA 22202-4704 OCT 2 6 2010 



MEMORANDUM FOR MAJOR GENERAL MARY A. LEGERE, U.S. ARMY, 

COMMANDING GENERAL, ARMY 
INTELLIGENCE AND SECURITY COMMAND, 
FORTBELVOIR, VA 

SUBJECT: Investigation under 5 U.S.C. § 2302(b)(8) 



We recently completed our investigation into allegations that Mr. James M, 
Helms, a former Intelligence Specialist at the Fort Knox field office of the 902nd 
Military Intelligence Group, received an unfavorable personnel security 
determination because of his whistleblowing activities. 

We substantiated the allegation that Agency officials reprised against 
Mr. Helms when recommending that his security clearance be revoked. We 
concluded that the Agency did not establish by clear and convincing evidence, a 
firm belief, that it would have taken the same action absent Mr. Helms' 
disclosures. Our report of investigation is attached. 

We recommend that you consider an appropriate remedy with respect to 
Mr. Helms. If you have any questions, please contact me or Mr. John Hickey, 
Acting Director, Civilian Reprisal Investigations, at (703) 604-8613. 




Deputy Inspector General for 
Administrative Investigations 

Attachment: 
As stated 



cc: Mr. James M. Helms 



CRI-HL 108920 



APPROPRIATED FUND EMPLOYEE 
WHISTLEBLOWER REPRISAL INVESTIGATION 

Mr. James Michael Helms 

INTRODUCTION AND SUMMARY 

We initiated this investigation in response to a Defense Hotline complaint received on 
January 12, 2009, from Mr. James Michael "Mike" Helms, a former GG-13 Intelligence 
Specialist, 902nd Military Intelligence (MI) Group, Fort Meade, MD. Mr. Helms was referred to 
the Office of the Inspector General, Department of Defense (DoD IG), Civilian Reprisal 
Investigations Directorate (CRI), after he filed a whistleblower reprisal complaint with the DoD 
Hotline. 1 

Mr. Helms alleged that he suffered seven acts of reprisal for making 14 disclosures. This 
report addresses only Mr. Helms' Defense Hotline complaint alleging: 

1 . the suspension of his access to classified information was in reprisal for 
making multiple disclosures; and 

2. the recommendation to revoke his clearance was in reprisal for making 
multiple disclosures. 

His remaining allegations of reprisal that concern other adverse personnel actions are before the 
U.S. Merit Systems Protection Board (M.S.P.B.) which lacks jurisdiction to review security 
clearance determinations as personnel actions. 

Mr. Helms' disclosures pertained to alleged violations of DoD rules regarding the 
medical treatment afforded to civilian employees injured in combat during Operation Iraqi 
Freedom, matters Mr. Helms reasonably believed evidenced a violation of law, rule, or 
regulation. Because Mr. Helms established a prima facie case of reprisal, the investigation 
shifted the burden of proof to the Agency, requiring clear and convincing evidence that the 
personnel actions would have been taken absent Mr. Helms' disclosures. 

We concluded the Agency: 

1 . provided clear and convincing evidence that Mr. Helms' access would have 
been suspended absent his disclosures; and 

2. did not provide clear and convincing evidence that the Agency would have 
recommended revocation action absent the disclosures. 



1 All titles and ranks identified pertained to the position(s) held at the time the incident took place and do not 
necessarily reflect an individuals' current rank or title. 
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^Therefore, we substantiated that Mr. Helms' 

U.S. Army,HH^^|, Bravo Company, 308th MI Battalion, 902nd MI Group, 
Fort Meade, a cting on advicefrom officials at the 902nd MI Group, reprised against Mr. Helms. 

was ultimatelyresponsible for recommending his security clearance be revoked. 
Evidence established that^^^^^^^H was relying primarily on the command-directed Army 
Regulation (AR) 15-6 investigation and guidance provided by the 902nd MI Group Legal office. 



This report sets forth our findings and conclusions based on applicable evidentiary 
standards. 



BACKGROUND 



The 902nd MI Group is located at Fort Meade, and provides direct and general 
counterintelligence support to Army activities and major commands. 2 It is a subordinate 
command of the United States Army Intelligence and Security Command (INSCOM). 3 
INSCOM is an Army major command that conducts intelligence, security and information 
operations for military commanders and national decision makers. Headquartered at Fort 
Belvoir, VA, INSCOM has multiple smaller components staffed by personnel dispersed over 180 
locations worldwide. 4 



Prior to Mr. Helms' employment as a civilian appropriated-fund employee, he enlisted as 
a counterintelligence agent in the U. S. Army in 1996. 5 He served in the 902nd MI Group, first 
as an enlisted soldier and then as a civilian employee. 6 He entered civilian employment with the 
902nd MI Group as a Military Intelligence Civilian Excepted Career Program (MICECP) 
employee, GG-9 in May 2002. 7 

The MICECP program is a career program charged with recruiting, training, and 
developing a highly qualified, technically skilled, foreign language capable, mobile workforce. 
MICECP employees in the Intelligence Operations Specialist (0132) job series conduct 
intelligence and counterintelligence operational missions for Army commands worldwide. 8 The 
MICECP program is managed by INSCOM. Mr. Helms was assigned to the Fort Knox Field 
Office, 902nd MI Group, Fort Knox, KY, as the Operations Officer. The Fort Knox Field Office 
is headed by the Special Agent in Charge (SAC), who reports to the Bravo Company 
Commander at Redstone Arsenal in Huntsville, AL. The Bravo Company Commander reports to 
the 308th Battalion Commander in Fort Meade, MD. The 308th Battalion Commander reports to 



2 INSCOM Website, http://www.inscom.army.mil. 

3 Id. 
"Id. 

5 DoD IG Interview of Mr. Helms (Sept. 25, 2009) at 6. 

6 Mr. Helms was enlisted from 1 996-200 1 . He joined the 902nd as a MICECP on May 20, 2002. From September 
1 1, 2001, until May 19, 2002, he was not associated with the Federal Government. 

7 DoD IG Interview of Mr. Helms (Sept. 25, 2009) at 7. 

8 MICECP Website, http://www.inscom.army.mil/Employment. 



Foi - Official Uac Only 



1KB) 
1K7XC) 



CRI-HL 108920 



3 



the 902nd Group Commander, also in Fort Meade, MD. As an Operations Officer, Mr. Helms 
conducted counterintelligence operations investigations and counterespionage operations 
investigations that were assigned to the Fort Knox Field Office. 9 He also assumed information 
assurance (IA) responsibilities, which included management of the office's computer network. 

In 2004 the 902nd MI Group deployed to Iraq. This deployment was unprecedented. 10 
On June 16, 2004, Mr. Helms was injured by an Improvised Explosive Device (IED). He was 
medically transported to Walter Reed Army Medical Center on July 2, 2004. 1 1 Not being on 
active duty, Mr. Helms was informed that there were no rooms available for him. On July 6, 
2004, he was refused treatment due to a coding error that identified him as a contract worker 
rather than a DoD employee. 12 Instead of being admitted to Walter Reed Army Medical Center, 
Mr. Helms slept on the floor at the guesthouse of his First Sergeant. 13 

Mr. Helms continued to be denied treatment at military treatment facilities. 14 In the 
course of attempting to obtain military medical treatment, Mr. Helms contacted several elected 
officials and members of the media for assistance. On September 18, 2007, and October 16, 
2007, the House Armed Services Committee (HASC), Subcommittee on Oversight and 
Investigations, conducted hearings into the deployment of civilian U.S. Government employees 
in Iraq and Afghanistan. The committee sought to understand how well the Government fulfills 
its obligation to support and adequately compensate those who are asked to take these 
assignments. 15 The committee held two open hearings as well as a closed-door panel discussion 
on October 2, 2007, with wounded DoD civilian personnel. 16 Mr. Helms was one of the DoD 
civilians who testified at the informal panel discussion on October 2, 2007. On April 30, 2008, 
the subcommittee released its report, Deploying Civilians to the Battlefield: Incentives, Benefits 
and Medical Care. Among its findings, the Subcommittee found that: 

the Department of Defense has policies, directives, and instructions in place for 
the provision of medical care to its civilian employees who serve in war zones in 
support of combat operations. However, these policies may not be sufficient to 
cover the full scope of the problems encountered; communicated to the entire 
workforce; implemented or understood by those responsible for supporting the 




9 DoD IG Interview of Mr. Helms (Sept. 25, 2009) at 5-6. 

10 DoD IG Interview of^^^^^^^^^^^H U.S. Anny.| 
21, 2010) at 5-6. 

11 DoD IG Interview of 

Reed Army Medical Center (Oct. 13, 2009) at 5. 

12 Id. at 5. 

13 Id. at 5. 

14 Id at 9. 

15 HASC Report, Deploying Civilians to the Battlefield (Apr. 2008) at 10. 



902nd MI Group, Fort Meade (Jan. 



Walter 



16 



Id. 
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provision of medical care to wounded and injured civilians; or adequately 
overseen by military leaders. 17 

During the period from 2004 to 2008 when Mr. Helms was making disclosures, he was a 
MICECP employee assigned to the Fort Knox Field Office. Mr. Helms was the office 
Operations Officer and Information Assurance Manager. In 2005, Mr. Helms created a stand- 
alone server that he named "Athena" (hereinafter referred to as the Athena server). 
The Athena server stored all of the operational files for the Fort Knox Field Office. Four to five 
staff-members working at the Fort Knox Field Office had access to the server, could log onto it, 
and could retrieve and update files. A copy of office members' computer usernames and 
passwords was kept in the office safe where the staff could access them. 18 The Athena server 
was used only by the Fort Knox Field Office internally and was not on the 902nd MI Group 
domain. 



In testimony during this investigation, members of the Fort Knox Field Office told us that 
commanders at Bravo Company and the 308th Battalion were aware of the Athena server. 19 
As Operations Officer, Mr. Helms provided briefings to incoming commanders during which he 
explained how the Athena server worked. 20 On April 25, 2008, after three years of operation, the 
Athena server was s hut down under the direct ion of the 902nd MI Group IA Office. The then- 
902nd Commander. ^^^^^^jjjj^^J^^J immediatelyordered^^ommander's Inquiry to 
determine if the Ath ena server was unauthorized. 21 the 902nd 

^^^1^^^^^^ conducted the inquiry. report, dated June 6, 2008, concluded that 
Mr. Helms operated an unauthorized com puter system for ap proximately 3 
Comm ander's Inquiry also concluded that | 

H^|, 308th MI Battalion, Fort Meade, knew of the Athena server for 3 years. 



/ears. 22 The 




U.S. 



In April 2008, th e 902nd MI Group underwent a cha nge of command. 

Arm yj|MM^M 902nd MI Group , Fort Meade, and | 

| . U^^rmyl^^^^HH^^M, 902nd MI Group, Fort Meade, ordered an AR 15-6 
Investigation on July 14, 2008, to investigate allegations of computer misuse at the Fort Knox 



Field Office. Forensic analysis of the hard drives uncovered media files, containing sexually 
explicit material, stored on the hard drives. The AR 15-6 investigation was subsequently 



17 HASC Report, Deploying Civilians to the Battlefield (Apr. 2008) at 10. 

18 DoD IG Interview ot ^^^^^^^H|[[^^^^^^^^^^|[| Fort Knox Field Office, 902nd MI Group, 

Fort Knox (Nov. 2, 2009Jat31^^^^ 

19 DoD IG Interview of^^^^^^B ^^^HB^^^BI Bravo Company, 308th MI Batta lion, Redstone Arsenal 
(Oct. 14, 2009) at ll-12^oTMGMeme\¥ofS^HH^I^^HM^III|^| U.S. Army, White House 

Military Office (Oct. 29, 2010) at 41; DoD IG JjiteroswoT^^^^^^^^^U^^rmy; SAC, Fort Knox Field 
Office, 902nd MI Group, Fort Knox (Nov. 5, 2010) at 44-45. 



20 



DoD IG Interview of 



U.S. Army, Fort Knox Field Office, 902nd MI Group, Fort Knox (Nov. 2, 



2009) at 31-32. 

21 AR 15-6 Investigation, Exhibit 7 (Oct. 2008) 

22 Id. 

23 ^^J and| 
Interview o 




testified that^^^^^H ordered that the AR 15-6 to go forwa rd. See DoD IG 
Jan. 21, 2010^tl2^oD IG Interview of^^^^HHHI (Jan. 21, 2010) at 12. 
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expanded to include whether Mr. Helms placed pornography on a classified computer network. 
The AR 15-6 investigation concluded that Mr. Helms used unlicensed software to create the 
Athena server; that he improperly connected the Athena server to the classified computer 
network at the Fort Knox Field Office; that he improperly connected classified network 
computers to an unclassified/unaccredited Army Criminal Investigation Division (CID) 
computer; and that he placed malicious software and sexually explicit material on the Secret 
Internet Protocol Router Network (SIPRNet). 24 

SCOPE AND AUTHORITY 

Under the Inspector General Act of 1978, as amended, the DoD IG is responsible for 
improving the economy, efficiency, and effectiveness of the Department's operations through 
prevention and detection of fraud, waste, and mismanagement. To fulfill those responsibilities, 
Congress granted the DoD IG broad powers to conduct and supervise investigations relating to 
the Department's programs and operations. The DoD IG achieves this goal, in part, by acting 
upon information provided by federal employee(s) in investigations conducted under Section 
7(a) and 8(c)(2) of the Inspector General Act. The DoD IG protects the confidentiality of 
sources providing information under the authority of Section 7(b) of the Inspector General Act. 

DoD Directive 5106.01 mandates that the Inspector General "[mjaintain a whistleblower 
protection program in the Department of Defense that encourages personnel to report fraud, 
waste, and abuse to appropriate authorities; provides mechanisms for addressing complaints of 
reprisal; and recommends remedies for whistleblowers who encounter reprisal, consistent with 
applicable laws, regulations, and policies." 25 One component of this whistleblower protection 
program is to "[rjeceive and investigate... complaints of reprisal made by civilian appropriated- 
fund employees" consistent with Title 5, United States Code, Section 2302 (5 U.S.C. § 2302). 26 

Employees of the DoD are required to report "waste, fraud, abuse and corruption to 
appropriate authorities." 27 Title 5 U.S.C. Section 2302 (b)(8) provides protection to DoD 
employees who make a "protected disclosure." A protected disclosure is a disclosure of 
information the employee reasonably believes evidences a violation of any law, rule, or 
regulation, or gross mismanagement, a gross waste of funds, an abuse of authority, or a 
substantial and specific danger to public health or safety, if such disclosure is not specifically 
prohibited by law and if such information is not specifically required by executive order to be 
kept secret in the interest of national defense or the conduct of foreign affairs. 28 



Oct. 2008, AR 15-6 Report of Investigation, exhibit 2 (DA Form 1574). 
DoD Directive 5106.01 (Apr. 13, 2006) at 5.19. 
DoD Directive 5106.01 (Apr. 13, 2006) at 5.19.1. 
Executive Order 12731 (Oct. 17, 1990). 
5 U.S.C. § 2302 (b)(8)(A)(i-ii). 
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Title 5 U.S.C., Section 2302 (a)(2)(A)(i) through (xi) lists personnel actions which, if 
taken, withheld, or threatened in reprisal for a disclosure, constitute "prohibited personnel 
practices." These personnel actions include disciplinary or corrective action; a detail, transfer or 
reassignment; a performance evaluation; a decision to order psychiatric testing or examination; a 
decision concerning pay, benefits, or award; or any other significant change in duties, 
responsibilities, or working conditions. 

Current guidance provides that the courts and the M.S.P.B. lack authority under title 5 to 
review security clearance determinations as personnel actions. Given the significance of such 
determinations to DoD employees, the DoD IG whistleblower protection program relies on the 
authority of subsections 7(a) and 8(c)(2) of the IG Act to review security clearance 
determinations as possible abuses of authority in the nature of reprisal. We have defined the 
following types of unfavorable personnel security determinations as reviewable: 

A suspension, denial, or revocation of clearance for access to classified 
information, access to classified information, Special Access authorization 
(including access to Special Compartmented Information (SCI)); a 
recommendation to a Central Adjudication Facility or comparable entity to 
suspend, deny, or revoke clearance for access to classified information or Special 
Access authorization (including access to SCI); non-appointment to or non- 
selection for any other position requiring trustworthiness determination; and 
reassignment to a position of lesser sensitivity or to a non-sensitive position. 29 

We employ a two stage process in conducting whistleblower reprisal investigations. 
The first stage focuses on the alleged disclosure, personnel action(s) and/or unfavorable 
personnel security determination, and acting official's knowledge. The second stage focuses on 
whether or not the Agency would have taken, threatened or withheld the personnel action(s) 
and/or unfavorable personnel security determination absent the disclosure. The first stage of the 
whistleblower reprisal analysis is held to a preponderance of the evidence. 30 "Preponderance" of 
the evidence is that degree of relevant evidence that a reasonable person, considering the record 
as a whole, would accept as sufficient to find that a contested fact is more likely to be true than 

31 

untrue. 

In order to progress to the second stage of the investigative process, there must be 
sufficient evidence based on proof by a preponderance of the evidence to make three findings: 

1 . the complainant made a protected disclosure; 

2. the complainant was the subject of an adverse personnel action and/or 
unfavorable personnel security determination; and 



Office of the Inspector General, U.S. Department of Defense, DoD IG Authority to Investigate Security Clearance 
Determinations in the Context of Civilian Appropriated Fund Employee Reprisal (Apr. 22, 2010). 

30 5 C.F.R. § 1209.7. 

31 5 C.F.R. § 1201.56(c)(2). 
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3. the disclosure was a contributing factor in the personnel action and/or 

32 

unfavorable personnel security determination. 

If a preponderance of the evidence supports the three findings above, the investigation 
will proceed to the second stage of the analysis. At that point, the Agency is afforded the 
opportunity to provide evidence regarding the allegations and specifically, evidence that would 
establish the Agency would have taken, withheld, or threatened the personnel action and/or 
unfavorable personnel security determination against the complainant absent the disclosure. 
The second stage of analysis is held to a clear and convincing evidence standard. 33 "Clear and 
convincing" evidence is that measure or degree of proof that produces in the mind of the trier of 
fact a firm belief as to the allegations sought to be established. It is a higher standard than 
preponderance of the evidence, but a lower standard than beyond a reasonable doubt. 34 

To address the fourth element, we consider the following three factors for presence of 
"clear and convincing" evidence: 

1 . the strength of the Agency' s evidence in support of its personnel action and/or 
unfavorable personnel security determination; 

2. the existence and strength of any motive to retaliate on the part of the Agency 
officials who were involved in the decision; and 

3. any evidence that the Agency takes similar actions against employees who are 
not whistleblowers but who are otherwise similarly situated. 

We interviewed 22 witnesses, including the complainant , Mr. Helms, and the 
^^^^^^Hj^^^^^^^^^H^^^^^^^^^^^^^^^^^^H. We also 
documentation provided by Mr. Helms, the Agency, and other independent sources. 



32 This third finding may be established where the acting official had knowledge, actual or imputed, of the 
complainant's disclosure and the personnel action took place within a period of time subsequent to the disclosure, 
such that a reasonable person could conclude that the disclosure was a contributing factor in the decision to take the 
action. Redschlag v. Department of the Army, 89 M.S.P.R. 589, 635 (2001), review dismissed, 32 Fed. Appx. 543 
(Fed. Cir. 2002) In deciding whether a personnel action occurred within a period of time sufficient to conclude the 
disclosure was a contributing factor, the probative value of the evidence may be affected by the passage of time. 
Weak but substantiating evidence may be sufficient to prove reprisal after a short time frame; stronger evidence may 
be required to prove reprisal over relatively longer time frames. 

33 5 U.S.C. § 1221(e)(2). 

34 5 C.F.R. § 1209.4(d). 

35 Carrv. Social Security Admin., 185 F.3d 1318, 1323 (Fed. Cir. 1999) (stating it is appropriate to consider the 
strength of the Agency's evidence in support of its personnel action when determining whether the Agency has 
shown by clear and convincing evidence that it would have taken that action in the absence of the employee's 
disclosure). 
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Mr. Helms had standing to file a Section 7 Complaint with the Defense Hotline because 
he was a full-time civilian employee of the DoD and his position was financed with appropriated 
funds. 36 We reviewed this complaint using as general guidance concepts consistent with title 5 
U.S.C. Section 2302 (b)(8). Mr. Helms alleged that he was reprised against for disclosing 
information that he reasonably believed evidenced a violation of law, rule, or regulation. 

CHRONOLOGY 

On June 16, 2004, Mr. Helms was injured by an IED as a U.S. Army civilian deployed in 

Iraq. 37 

On September 20, 2004, Mr. Helms contacted the office of Senator Mitch McConnell, 

38 

KY, alleging he was denied treatment at military treatment facilities, and requested assistance. 

t q 

On or about November 2004, Senator McConnell's office opened a case for Mr. Helms. 

On April 14, 2005, Mr. Helms contacted staff from the Senate Armed Services 
Committee (SASC) regarding denial of treatment and delayed compensation for injuries 
sustained in Iraq. The SASC asked for a briefing from INSCOM, Army Deputy Chief of Staff, 
and Office of the Secretary of Defense. 40 

On or about September 2005, Mr. Helms contacted Senators John Cornyn, TX, John D. 
Rockefeller, WV, William Frist, TN, and John McCain, AZ, regarding problems with the DoD 
and Department of Labor (DoL). His inquiries were forwarded to Senator McConnell and 
Representative Jim Bunning, KY. 41 

On or about September 2005, Mr. Helms sent e-mails to the President and Vice President 
of the United States alleging he was denied treatment at military treatment facilities. No action 
was taken as a result of these e-mails 42 



36 Title 5 U.S.C. Appendix 3 § 7(A)(2008) (provisions by which a DoD employee may file complaints with the 
Inspector General). 

37 DoD IG Interview of 

38 Letter from Mr. Helms to Sen. Mitch McConnell (Sept. 20, 2004). 

39 Id. 

40 E-mail from Mr. Helms 10^^. SASC Staff Member, Recontact (Apr. 14, 2005, 7:31 a.m.). 

41 Letter from Sen. Cornyn to Mr. Helms (Sept. 7, 2005); Letter from Sen. Rockefeller to Mr. Helms (Sept. 13, 
2005); Letter from Sen. Frist to Mike Helms (Sept. 29, 2005); Letter from Sen. McCain to Mr. Helms (Nov. 13, 
2005). 

42 E-mail from Mr. Helms to George W. Bush, President of the United States, Combat injured civilian in need of 
help (Sept. 2005, 1:38 p.m.); E-mail from Mike Helms, Complainant to Richard Cheney, Vice President of the 
United States, Combat injured civilian in need of help (Sept. 2005, 1:22 p.m.). 
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308th MI Battalion, Fort Meade, was notified by 
I 902nd MI Group, Fort Meade about the Athena 



server. 




this order was rescinded after Mr. Helms' request for medical stabilization was approved. 

On or about May 2006, Mr. Helms filed a complaint with the Office of Special Counsel 
(OSC) alleging his command was attempting to reassign him as reprisal for communications 
with Congress. 45 

On or about June 2006, Mr. Helms contacted Senator Chuck Hagel's, NE, office 
regarding the denial of treatment at military treatment facilities. 46 

On or about June 2006, Mr. Helms filed a complaint with the Department of the Army 
Inspector General (DAIG) regarding the denial of treatment at military treatment facilities. 47 

On July 7, 2006, Mr. Helms filed a complaint with the INSCOM IG regarding the denial 
of treatment at military treatment facilities. 48 

On April 2, 2007, Mr. Helms contacted Brigadier General (BG) Michael S. Tucker, 
U.S. Army, Deputy Commanding Officer, Walter Reed Medical Center, regarding his denial of 
medical treatment at military treatment facilities. 49 

On June 7, 2007, Mr. Helms contacted Ms. Patricia Bradshaw, Deputy Under Secretary 
of Defense for Civilian Personnel Policy, Pentagon, regarding his denial of medical treatment at 
military treatment facilities. 50 

On July 25, 2007, an article about Mr. Helms, Service Civilians and the Wounds of War, 
by Ms. Ann Scott Tyson was published in The Washington Post. 51 



43 AR 15-6 Inves tigation, Exhibi t 3 (Oct. 2008)^^^^^^H could not remember the exact date^Jwas notified 
about the server. did not recall the conversation). 

44 OSC complaint MA-06-171 1 (May 2, 2006). 

45 Id. 

46 DoD IG Interview of Mr. Helms (Sept. 25, 2009) at 21. 



47 



Id. at 35. 



48 



Id. at 35. 



49 



Id. at 36. 



50 



Id. at 37. 



51 



Ann Scott Tyson, Service Civilians and the Wounds of War, The Wash. Post, July 25, 2007 at Al. 
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On or about July 2007, Mr. Helms contacted the U.S. Army Joint Field Support Center 
(JFSC) and alleged that INSCOM violated Health Information Privacy Accountability Act 
(HIPAA) regulations by mishandling medical records. 52 

On October 2, 2007, Mr. Helms testified at a closed-door briefing in front of the HASC, 
Subcommittee on Oversight and Investigations regarding the denial of treatment at military 
treatment facilities and inefficiency of the DoL Office of Workers' Compensation Program 
(OWCP). 53 

On or about A pril 2008, the 902nd MI Group IA office alleged that the Athena server 
was a "rogue" server. JU^^^ subsequently directed a Commander's Inquiry to investigate 
computer configuration. 

On April 25, 2008, the Athena server was shut down under the direction of the 902nd IA 
Officer. 55 

On April 30, 2008, the HASC report, Deploying Federal Civilians to the Battlefield: 
Incentives, Benefits, and Medical Care, was published. One of the HASC findings was that 
military treatment facility staff do not understand the responsibilities of admitting civilians and 
submitting claims through the DoL OWCP. 56 

On May 5, 2008, Mr. Helms was quoted in a Federal Times article by Mr. Stephen 
Losey, Wounded in war, ill-treated at home. 51 In the article, Mr. Helms stated that he was 
refused treatment at Ireland Army Community Hospital, Fort Knox, and was charged $2,500 for 
a treatment by a civilian doctor. 

On May 5, 2008, General Dynamics contractors conducted a physical inspection of the 

CO 

Fort Knox Field Office computers. 

On May 20, 20 08, Mr. Helm s received verbal and written counseling from I 

U.S. Army.^^^^J. 308th MI Battalion, 902nd MI Group, Fort Mead because 
of working over his six-hour-day limit. 59 



52 DoD IG Interview of Mr. Helms (Sept. 25, 2009) at 37-38. 

53 See Wounded U.S. Civilians and their Professional Associations: Informal Member Session before the H. Armed 
Services Comm., 110th Cong. (2007) (statement of Mr. Helms). 

54 AR 15-6 Investigation, Exhibit 3 (Oct. 2008). 

55 Id. 

56 Deploying Federal Civilians to the Battlefield: Incentives, Benefits, and Medical Care, H. Comm. Print No. 9 
(Apr. 2008). 

57 Stephen Losey, Wounded in war, ill-treated at home, Fed. Times, May 5, 2008. 

58 AR 15-6 Investigation, Exhibit 3 (Oct. 2008). 

59 Letter of Counseling from|^^^^^m t0 M*- Helms (May 19, 2008). 

Foi ' Official Ujc Only 

b(B} 
b(7XC) 



CRI-HL 108920 



11 



On or about May 2008, all hard drives at the Fort Knox Field Office were disconnected. 
Mr. Helms shipped nine classified hard drives from the Fort Knox Field Office to Fort Meade. 60 

On June 6, 2008, reported J findings in the Commander's Inquiry. The 

report stated: 

Since 2005, Mr. Helms of the Fort Knox field office has installed and 
operated an unauthorized domain called 'ATHENA' on the SIPRNet. 
This domain was implemented with the use of unlicensed Windows 
2003 Server Software he obtained in Iraq and a variety of 
unauthorized Freeware and Shareware software he downloaded from 
the internet. In addition to the unauthorized domain, Mr. Helms also 
provided unauthorized SIPRNet connectivity to the local CID office 
by connecting a workstation for them to the field office SIPRNet 
network and providing user accounts via the unauthorized Athena 
domain; 61 and 

It is apparent that Mr. Helms knowingly implemented this 
unauthorized Athena Domain, unauthorized CID connectivity to the 
FO's [Field Office's] SIPRNet network, and the useof unlicensed and 
imauthorizedsoftware. It is also apparent that I'^IH^^I 
HjH^^HHHjH failed in^| responsibilities to enforce required 
policies and regulations to ensure this field office was operating per 
prescribed Information Assurance and Security guidelines. 62 

On July 10, 2008, ^^^^^H sent a Serious Incident Report (SIR) to the Commanding 
General of INSCOM reportmgthediscovery of an unauthorized computer network at the Fort 
Knox Field Office. 63 

On July 11, 2008, a separate Initial Incident Report was reported to the Army Central 
Clearance Facility (CCF) stating: 

[Mr. Helms] set up an unauthorized network on the SIPRNET system using 
potentially unlicensed/pirated software from 2005 until it was shut down by 
Information Assurance personnel on 25 Apr 08. The Commander has directed an 
AR 15-6 investigation. 



AR 15-6 Investigation, Exhibit 7 (Oct. 2008); Classified Document Accountability Record, DA Form 3964, Reg. 
No. 790500816767 (May 6, 2008). 

61 AR 15-6 Investigation, Exhibit 7 (Oct. 2008). 

62 Id. 

63 Id. at Exhibit 8 (Oct. 2008). 

64 James M. Helms, JPAS Summary (July 11, 2008). 
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look into whether Mr. Helms misused Government information technology (IT) systems, 
connected an unauthorized computer to a classified Government network, used unlicensed 
software on a Government computer system, connected unaccredited Criminal Investigation 
Division (CID) computers to a classified network, and compromised classified material. 65 

On August 18, 2008, the 902nd MI, Cyber Counterintelligence Activity (CCA), reported 
that they found pornographic files stored on the Athena server through their forensic analyses of 
the Fort Knox Field Office hard drives. 66 

On August 19, 2008, the scope of the AR 15-6 investigation was expanded to include 
whether Mr. Helms placed pornography on classified or unclassified systems. 67 

On August 27, 2008, Mr. Helms received a written counseling from^m^^^J 
regarding derogatory information uncovered by the Commander's Inquiry. Mr. Helms' access to 
classified information was suspended and he was placed on Administrative Leave pending 
completion of the AR 15-6 investigation. A follow up incident report was sent to CCF, which 
included an allegation that Mr. Helms placed pornography on a classified government 
computer. 68 

On October 16, 2008, Mr. Helms received and signed a notice of proposed indefinite 
suspension stating that he was being suspended without pay for efficiency based on the 
suspension of his access to classified information. 69 

On October 24, 2008, Mr. Helms responded to the notice of proposed indefinite 
suspension and requested "Whistleblower Protection Status." 70 

On October 24, 2008, Mr. Helms filed a complaint with the DoD IG Hotline alleging 
reprisal for whistleblowing. 71 

On October 28, 2008, a follow up incident report was sent to CCF stating that 
Mr. Helms' local access to classified information was suspended. 72 



AR 15-6 Investigation, Exhibit 1 (Oct. 2008). 
Id. at Exhibit 13. 
Id. at Exhibit 1. 



70 



691 



68 




71 



DoD Hotline Complaint 108920 (Oct. 24, 2008). 
JPAS Summary, Mr. Helms (Oct. 28, 2008). 



72 
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On November 25, 2008, ^^^^^^H sent a signed memorandum recommending the 
revocation of Mr. Helms' Security Clearance to the 902nd Group Legal office. This 
memorandum was not forwarded to CCF. 

On December 3, 2008, an Adverse Action (Douglas Factors) checklist was completed by 



74 




proposing a 30-day suspension for Mr. Helms. 

On December 9, 2008, an Adverse Action checklist was completed byl 

sustaining proposed indefinite suspension without pay and subsequently notified Mr. Helms of 
decision. 75 

On October 23, 2009, the DoD IG contacted the 902nd Security Office to inquire as to 
the status of Mr. Helms' security clearance, since Mr. Helms had not yet received a Letter of 
Intent (LOI) from CCF. 76 

On October 28, 2009, the final incident report was sent by the 902nd MI Group to CCF to 
begin adjudication of Mr. Helms' security clearance. 



77 



78 

On November 6, 2009, Mr. Helms was removed from federal service. As of October 
19, 2010, CCF has yet to make a security clearance determination. Further, they have yet to 
receive SF-50 notification that Mr. Helms was removed from federal service. 79 

FINDINGS AND ANALYSIS 

1. Did Mr. Helms make a protected disclosure? Yes. 

To determine whether a disclosure qualifies as protected, we employ a two step process 
based on statute and case law. First, we determine whether the communication fits within the 
definition of a disclosure under 5 U.S.C. Section 2302 (b)(8). Next, we determine whether the 
communication fits within the categories of protected disclosures recognized by the U.S. Court 
of Appeals for the Federal Circuit in Huffman v. Office of Personnel Management, 263 F.3d 
1341, 1353 (Fed. Cir. 2001). 




902nd MI Grp, Helms (Nov. 25, 2008, 1:23 p.m.); MFR from 



73 E-mail froml 

| to CCF, Intent to Revoke Security Clearance (Nov. 25, 2008). 

Douglas Factors Checklist (Dec. 3, 2008). 

Douglas Factors Checklist (Dec. 9, 2008). 

76 DoD IG Interview oi^HH^^H HH^^I 902nd M1 Grou P> Fort Meade ( 0ct 29 > 2009 ) at 1 3 " 1 4: 
CCF must forward a lette^fnTtent(LOI) throu^nth^ommand security manager to the individual. This LOI will 
outline the derogatory information and explain the proposed action. It will offer the person a chance to reply in 
writing with an explanation, rebuttal, or mitigation for the incidents. AR 380-67, 8-201(a)(2) and 8-201(b). 

77 IPAS Summary, Mr. Helms (Oct. 28, 2009). 

7g jjj^^^^^m^^^^^^^^mH^^|, Notice of Decision to Remove (Nov. 2009). 
79 E-mail from CCF to DoD IG, Helms (Oct. 19, 2010, 1 :39 p.m.). 



Fui Official U&b Oul> 



b(B> 



CRI-HL 108920 



14 



Title 5 U.S.C. Section 2302 prohibits an Agency from taking, failing to take, or 
threatening a personnel action against a civilian employee, organized under Title 5 (appropriated 
fund), for making a protected disclosure. Section 2302 defines a protected communication as 

80 

any disclosure of information, which the employee reasonably believes evidences: 

1 . a violation of any law, rule, or regulation; or 

2. gross mismanagement, a gross waste of funds, an abuse of authority, or a 
substantial and specific danger to public health or safety. 

In Huffman, the U.S. Circuit Court of Appeals for the Federal Circuit outlined the 
following three categories into which a disclosure may fall. Only the latter two constitute 
disclosures that are protected under the Whistleblower Protection Act: 

1 . disclosures made as part of normal duties through normal channels; 

2. disclosures made as part of normal duties outside of normal channels; and 

3. disclosures made outside of assigned duties. 

Additionally, to qualify as a protected disclosure under Huffman, the allegation of 
wrongdoing must be made to someone other than the wrongdoer. 8 

We identified 15 communications made by Mr. Helms: 

1 . On September 20, 2004, Mr. Helms contacted the office of Senator McConnell 
alleging he was denied treatment at military treatment facilities, and requested 
assistance. 

2. On April 14, 2005, Mr. Helms contacted staff from the SASC regarding his 
denial of treatment and delayed compensation for injuries sustained in Iraq. 
The SASC asked for a briefing from INSCOM, Army Deputy Chief of Staff, 
and Office of the Secretary of Defense. 



80 To satisfy this element the complainant is not required to disclose information that actually evidences one of those 
conditions. Rather, the complainant is only required to make a non- frivolous allegation that the matters disclosed 
were ones that a reasonable person in his or her position would believe evidenced one of those conditions. See 
Rusin v. Dep 't of the Treasury, 92 M.S.P.R. 298, 3 1 8 (2002). See also Garst v. Dep 't of the Army, 60 M.S.P.R. 514, 
5 1 8 (1994). Reasonable belief is an objective standard. That is, a disinterested observer with knowledge of 
essential facts known to and readily ascertainable by the employee could reasonably conclude that the actions 
evidence a violation of a law, rule, or regulation. See Lachance v. White, 174 F.3d 1378, 1381 (Fed. Cir. 1999); 
accord Rusin, id. 

81 Huffman, supra, at 1348-1350, citing Willis v. Dep't of Agriculture, 141 F.3d 1139, 1143 (Fed. Cir. 1998) and 
Horton v. Dep't of Navy 66 F.3d 279, 282 (Fed. Cir. 1995). 
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3. In September 2005, Mr. Helms contacted Senators Cornyn, Rockefeller, Frist, 
and McCain regarding problems with the DoD and DoL. His inquiries were 
forwarded to Senator McConnell and Representative Bunning. 

4. In September 2005, Mr. Helms sent e-mails to the President and Vice President 
of the United States alleging he was denied treatment at military treatment 
facilities. No action was taken as a result of these e-mails. 

5. In May 2006, Mr. Helms filed a complaint with OSC alleging his command 
was attempting to reassign him as reprisal for communications with Congress. 

6. In June 2006, Mr. Helms contacted Senator Hagel's office regarding the denial 
of his medical treatment at military treatment facilities. 

7. In June 2006, Mr. Helms filed a complaint with the DAIG regarding the denial 
of his medical treatment at military treatment facilities. 

8. On July 7, 2006, Mr. Helms filed a complaint with the INSCOM IG regarding 
his denial of medical treatment at military treatment facilities. 

9. On April 2, 2007, Mr. Helms contacted BG Tucker, Walter Reed Army 
Medical Center, regarding the denial of his medical treatment at military 
treatment facilities. 

10. On June 7, 2007, Mr. Helms contacted Secretary Bradshaw, Deputy Under 
Secretary, Civilian Personnel Policy, regarding the denial of his medical 
treatment at military treatment facilities. 

11. On July 25, 2007, The Washington Post published an article about Mr. Helms, 
Service Civilians and the Wounds of War, by Ann Scott Tyson in which 

Mr. Helms was quoted as stating he had been denied treatment at military 
treatment facilities. 

12. In July 2007, Mr. Helms contacted the U.S. Army Field Support Center and 
alleged that INSCOM violated HIPAA regulations by mishandling medical 
records. 

13. On October 2, 2007, Mr. Helms testified at a closed-door briefing in front of the 
HASC, Subcommittee on Oversight and Investigations, regarding the denial of 
treatment at military treatment facilities and inefficiency of the DoL OWCP. 

14. On May 5, 2008, Mr. Helms was quoted in a Federal Times article by Stephen 
Losey, Wounded in war, ill-treated at home. In the article, Mr. Helms stated 
that he was refused treatment at Ireland Army Community Hospital, Fort Knox, 
and was charged $2,500 for a treatment by a civilian doctor. 
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15. On October 24, 2008, Mr. Helms filed a complaint with the DoD IG Hotline 
alleging reprisal for whistleblowing. 

We determined that all but one of Mr. Helms' communications, stated above, met the 
requirements under 5 U.S.C. Section 2302 and Huffman. Mr. Helms' communications from 
2004 through 2008 to elected officials, congressional staff, senior DoD officials, and IGs 
constituted disclosures because they were made outside his chain of command, concerned 
matters outside his official duties, and concerned actions he reasonably believed constituted a 
violation of law, rule, or regulation. Additionally, 5 U.S.C. Section 2302(b) provides protection 
to DoD employees who make protected disclosures to Congress. 82 

We found that Mr. Helms' belief that DoD Directive (DoDD) 1404.10 was being violated 
in the course of his attempts to obtain treatment was reasonable. The version of DoDD 1404.10 
in place at the time stated: 

[Emergency Essential] employees who require treatment for disease 
or injury sustained overseas during hostilities may be provided care at 
no cost to the employee under DoD Military Health Services System. 
The scope of care provided shall be equivalent to that received by 

83 

active duty military personnel. 

84 

Mr. Helms was an emergency essential employee. The testimony of Secretary 
Bradshaw, before the HASC Oversight and Investigations Subcommittee explained that this 
directive gave the employee the choice to elect treatment at a military treatment facility at no 
cost to the employee. Additionally, testimony from 902nd MI Group personnel and personnel 
from DoD medical facilities supports the reasonableness of Mr. Helms' allegations. 86 

As an emergency essential employee, Mr. Helms was entitled to elect treatment at a 
military treatment facility for no cost. 7 Mr. Helms was denied treatment at military treatment 
facilities on several occasions from 2004 to the present. Additionally, 902nd MI Group 
employees were told before deployment that medical care would be provided should they be 
injured in theater. 88 Therefore, we find that Mr. Helms' belief that DoD policy was being 
violated when he was denied and/or charged for medical treatment was reasonable. 



2302(b) ("This subsection shall not be construed to authorize the withholding of information from the 
Congress or the taking of any personnel action against an employee who discloses information to the Congress."). 

83 DoDD 1404.10 (Apr. 10, 1992) at 6. 

84 Letter from GEN John F. Kimmons, U.S. Army, Commanding General, INSCOM, to Deputy Chief of Staff, G-2, 
Benefits for Wounded/Injured Federal Employees (Nov. 1,2004). 

85 Prepared Statement of the Honorable Patricia Bradshaw, Benefits and Medical Care Afforded to Civilian 
Employees Deployed to Iraq and Afghanistan, " (Sept. 18, 2007). 

86 DoD IG Interviewof^HI|HII 308th MI Group, 902nd MI Group, Fort Meade (Dec. 3, 2010) at 12; DoD 
IG Interview of^J^^J(Oc03??009) at 5-6. 

87 DoDD 1404.10 (Apr. 10, 1992) at 6. 

88 DoD IG Interview of Mr. Helms (Sept. 25, 2009) at 10; DoD IG Interview olflHIH (Dec. 3, 2010) at 12. 
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We also find that Mr. Helms' communications to The Washington Post and Federal 
Times were protected. Disclosures to the press are protected under the WPA, as the press is a 
recognized outlet that may facilitate the correction of wrongdoing. 89 In these articles, Mr. Helms 
reported violations of DoD rules and DoL rules regarding medical treatment for civilians injured 
in combat zones. Specifically, these articles quote Mr. Helms as saying he was either denied or 
charged for treatment. Therefore, the disclosures in those news articles are also protected 
communications. 

We found that Mr. Helms' July 2007 communication to the Joint Field Support Center 
was not protected because it was impermissibly vague. In order for a disclosure to be protected 
it must be sufficiently specific. 90 This communication was a broad complaint of the command 
generally mishandling information. Mr. Helms specified neither the officials that mishandled 
documentation nor what documents were missing. Therefore, this communication was not a 
disclosure within the meaning of the WPA. 

Accordingly, we found that Mr. Helms made 14 disclosures. 

2. Was Mr. Helms the subject of unfavorable personnel security determinations? Yes. 

Mr. Helms alleged that seven actions were taken against him by commanders at the 
902nd MI Group, Fort Meade. Those alleged actions are: 

1 . Threatening reassignment from Fort Knox to Fort Meade or termination; 

2. Written Counseling concerning time management; 

3. An AR 15-6 investigation; 

4. Temporary suspension of access to classified information; 

5. Indefinite suspension without pay; 

6. Recommendation to revoke his security clearance; and 

7. Termination. 

Of the seven, we investigated two allegations: 

1. The suspension of his access to classified information; and 

2. The recommendation to revoke his clearance. 



89 Horton v. Dep't of Navy, 66 F.3d 279, 282 (Fed. Cir. 1995) (noting that disclosures to the press may be 
disclosures); H.R. Rep. No. 100-413, at 12-13 (1988) (listing the media as an independent entity, such as the 
Inspector General and Congress, to which disclosures may be made). 

90 See Padilla v. Dep 't of Air Force, 55 M.S.P.R. 540, 543-44 (1992) (a protected disclosure must be specific and 
detailed, not vague allegations of wrongdoing). 
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For purposes of analysis, allegations one, two, five, and seven were not investigated by 
CRI because the complainant appealed those actions to the M.S.P.B. Action three is material to 
establishing the basis for the unfavorable personnel security recommendation in this case and 
will be analyzed as such. 91 

The su spension of access to classified information and the recommendation by 

| to the CCF to revoke Mr. Helms' security clearance are reviewable as unfavorable 

personnel security determinations. Therefore, we concluded that Mr. Helms was subject to two 
unfavorable security determinations: the August 27, 2008, suspension of access to classified 
information and the Novem ber 25, 2008, recommendation to revoke Mr. Helms' security 
clearance by I 




3. Did^^^^^mm have knowledge, actual or implied, of Mr. Helms' disclosures, and 
did the unfavorable personnel security determinations take place within a period of time 
subsequent to the disclosures, such that a reasonable person could conclude that the 
disclosures were a contributing factor in the decision to take the unfavorable personnel 
security determinations? Yes. 

We found by a preponderance of the evidence that the acting official did have knowledge 
of Mr. Helms' disclosures to a reporter with The Washington Post and to the HASC, and took 
unfavorable personnel security determinations within a period of time after the disclosures to 
conclude that the disclosures was a contributing factor. The 902nd MI Group Public Affairs 
Office would send out notifications when Mr. Helms appeared in the media, notifying 
commanders that Mr. Helms was in the news. 92 ^!^!^^^ testified that J knew of 
Mr. Helms' complaints regarding his medical care^j^plso testified that before J took 
commandH became aware about a media article about Mr. Helms and that he testified before 
Congress. 

Additionally, personnel who influenced ^^^^^^^^ decision making 
confirmed that they were aware of Mr. Helms' disclosures both to the media and to the HASC. 
j^^^^^^J testified that | was instructed by officials in the 902nd MI Group Legal office to 
suspend Mr. Helms' access to classified information and recommend the revocation of his 
security clearance. 95 H^m^^^J ^^^^^H[|- 902nd MI Group, Fort Meade, testified 
thatH was aware of Mr. Helms' disclosures to a reporter with The Washington Post and the 



HASC. 



testified thatl 



was also involved in the decision to suspend 



SeeMongirdv. Dep'tofNavy, 33 M.S.P.R. 504, 507 (1987). 



DoD IG Interview of 



10. 



DoD IG Interview of 
'Id. at 9-11. 

Id. at 36. 
' DoD IG Interview of 



, 902nd MI Group, Fort Meade (Dec. 15, 2009) at 



(Dec. 11, 2009) at 8. 



I (Dec. 10, 2009) at 12-13. 
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Mr. Helms' local access and^^^^^H testified that^B had knowledge of Mr. Helms' 
disclosures to The Washington Post and the HASC. 

suspended Mr. Helms' access to classified information 13 months and two 
days after Mr. Helms' name appeared in The Washin gton Post; and 10 months and 25 days after 
Mr. Helms testified before Congress. recommended to the CCF that Mr. Helms' 

security clearance be revoked 16 months after Mr. Helms appeared in The Washington Post; and 
1 3 months after Mr. Helms testifiedbeforeCongress. Therefore, we determined by a 
preponderance of the evidence that^^^^^^^J had knowledge of the aforementioned 
disclosures and that these disclosures were a contributing factor in the personnel action. 

4. Is there clear and convincing evidence that the Agency would have taken, withheld, or 
threatened the unfavorable personnel security determinations against the complainant 
absent the disclosure? No ~ for the recommendation to revoke Mr. Helms clearance; Yes - for 
the earlier decision to suspend his access. 

In determining whether the Agency has established, by clear and convincing evidence, 
that the unfavorable personnel security determinations would have been taken, withheld, or 
threatened absent the disclosures, we consider three factors: the strength of the Agency's 
evidence in support of its personnel action; the existence and strength of any motive to retaliate 
on the part of the Agency officials who were involved in the decision; and any evidence that the 
Agency takes similar actions against employees who are not whistleblowers, but who are 
otherwise similarly situated. Clear and convincing evidence is that measure or degree of proof 
that produces in the mind of the finder of fact a firm belief as to the allegations sought to be 

98 

established. 

We will first discuss the re commendation to revoke Mr. Helms' security clearance set 
forth in a mem orandum signed by^^J^jj^J on November 28, 2008, and then 
earlier decision (August 27, 2008) to suspend his access. 

Recommendation to Revoke Mr. Helms' Security Clearance 

We determined that the Agency did not establish by clear and convincing evidence that 
the recommendation to revoke Mr. Helms' security clearance would have occurred absent his 
disclosures. We base this determination on flaws in Agency evidence used to justify the 
recommendation to revoke, the existence of motive to reprise on the part of responsible Agency 
officials, and the disparate treatment of Mr. Helms when compared to another Agency official 
who also bore responsibility for the security lapses documented by the Agency. 



DoD IG Interview of 
1 5 C.F.R. § 1209.4(d). 



(Jan. 21, 2010) at 8; DoD IG Interview of 
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Strength of Evidence in Support of the Unfavorable Personnel Security Determination. 

We determined that the Agency's evidence in support of its action did not meet the clear 
and convincing standard because it was undermined by: (1) deficiencies in the conduct of the 
AR 15-6 investigation on which the recommendation to revoke Mr. Helms' clearance was based; 
(2) the Agency's failure to determine whether classified information was compromised as 
required by applicable guidance; (3) a material misstatement of fact in the correspondence to the 
CCF which recommended the security clearance revocation; and (4) the Agency's failure to 
timely forward to the CCF the recommendation to revoke Mr. Helms' security clearance, thereby 
depriving Mr. Helms of due process. We address these factors below. 

The AR 15-6 Investigation 

In ^[memo randum to the C CF dated November 25, 2008 (but not actually delivered 
until October 2009), ^Hj^^^J listed the following four reasons for J recommendation to 
revoke Mr. Helms' security clearance: 



1 . "On August 27, 2008, Mr. Helms had his local access to classified 
information suspended based upon derogatory information obtained during the 
course of an AR 15-6 investigation into allegations of misuse of Government 
information technology equipment. At the conclusion of the investigation, the 
allegations were substantiated and proven to be true." 99 

2. "The results of the AR 1 5-6 investigation confirmed Mr. Helms put 
inappropriate and pornographic photos, videos, and audio files onto a 
classified Government computer." 100 

3. "Mr. Helms admitted in his statement to the investigating officer he knew his 
actions were wrong and yet continued even after being told to cease by the 
Battalion IMO." 101 



4. "In addition to the misconduct itself, Mr. Helms received guidance on the 
applicable security regulations and polices within the 902d MI Group and the 
U.S. Army concerning use and misuse of Government information technology 
equipment, he demonstrated a pattern of disregard for these regulations and 
policies, and his irresponsibility causes me to question his judgment." 102 



While some of the conclusions reached in the AR 15-6 investigation are not in dispute, 
the manner in which the investigation was conducted is called into question. We found the 



MFR froml 



100 



Id 



101 Id 

102 MFR froml 



| to CCF, Intent to Revoke Security Clearance (Nov. 25, 2008). 

| to CCF, Intent to Revoke Security Clearance (Nov. 25, 2008). 
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support for the Agency's reasons, as stated above, to be weakened by the failure to conduct a 
complete investigation. 

AR 15-6 charges the investigating officer "to ascertain facts and to report them to the 
appointing authority. It is the duty of the investigating officer ... to ascertain and consider the 
evidence on all sides of each issue, thoroughly and impartially, and to make findings and 
recommendations that are warranted by the facts and that comply with the instructions of the 
appointing authority." 103 The 10 failed to comply with requirements in this case, to include: 



The 10 was aware that Mr. Helms' superiors, to include Battalion and Group 
Commanders, were briefed on the Athena server dur ing their visit s to the Fort 
Knox Field Office. 104 Further, Mr. Helms mentionec^^^^^^B by name in his 
sworn AR 15-6 statement. However, the 10 never interviewed those 
commanders, to include I 



Mr. Helms alleged in his sworn AR 15-6 statement that^^^^^f granted a CID 
request to use the Field Office's SIPRNet an d directed M^ H^lmsto establish two 
accounts. 105 Again, the 10 never interviewed! 

Mr. Helms alleged in his sworn AR 15-6 statement that "I am certain | 

^^^^^^^^^JHjj^^^^H at higher headquarters] told me to te st the ideaT 
[of the Athena server] to see if it worked." The 10 never interviewed! 
and 




The 10 failed to interview any of the Field Office personnel about the 
pornography matter. 

The AR 15- 6 investigat ion cites only four sworn statements: 

and ^^^^^H 106 The 10 did not interview other witnesses at Fort Knox having 
access to the Athena server. Of particular concern is the fact that of the four sworn statements, 
only Mr. Helms mentions pornography. In his sworn statement, Mr. Helms denies placing 
pornography on the Athena server. The prudent investigator would have interviewed all 
witnesses with access to the server to verify the facts taken from the forensic report. 



Failure to Determine Impact 



Additionally, the AR 15-6 investigation failed to address whether there was a 
compromise of classified information, as required by applicable guidance and the direction of the 
appointing officer. Both DoD 5200. 1-R, "Information Security Program," Chapter 10, and 



103 AR 15-6 Procedures for Investigating Officers and Board Officers (Oct. 2, 2006) at 1-6. 

104 AR 15-6 Investigation, Exhibit 7 (Oct. 2008), Exhibit (B) Mr. Helms Information Paper (Apr. 25, 2008), Exhibit 
(C) Mr. Helms Memorandum for Record (May 6, 2008). 

105 AR 15-6 Investigation, Exhibit 14 (Oct. 2008). 

106 AR 15-6 Investigation (Oct. 2008). 
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AR 380-5, "Department of the Army Information Security Program," Chapter 10, require the 
Command to immediately initiate a preliminary inquiry into a report of possible compromise of 

1 A-7 

classified information. 



The failure of the 15-6 to address this question is notable for several reasons. First, the 
Command failed to comply with the requirements of DoD and Army guidance related to the 
handling of classified information and potential damage to national security. Second, the 
Command failed to follow-through on its representation to the INSCOM Commander, in the 
"Serious Incident Report," dated July 10, 2008, that the 902d MI Group AR 15-6 investigation 
will "determine potential of compromise and possible damage assessment." Third, the IO failed 
to comply with the direction of the appointing authority to answer, "Was there a compromise of 
classified material?" And fourth, whether or not Mr. Helms' actions actually compromised 
classified information would be a significant factor to be considered by both Command in its 
decision whether to recommend Mr. Helms' clearance be revoked and CCF in its revocation 
decision. 



Despite the IO's failure to address the security impa ct of the Ath ena server, when 
justifying the actions taken regarding Mr. Helms' clearance^^^^^^H^and^^^^^^^J 

emphasized the serious nature of the security violation. 108 ||H^^^Hstated that Mr. Helms' 
activities were "undermining the integrity of the SIPRNet,'^vhile^^^^MB noted that 
Mr. Helms' superiors might have shut down the server sooner "had they truly understood the 
vulnerability that was emanating from this office." However, when asked why an impact 
analysis was not conducted, their testimony indicated that determining the extent of the security 
impact was not a priority. 109 This assessment was impossible without knowing the impact of the 
security breach. 



Material Misstatement of Fact 



An additional irregularity is mat^^^^U' memoranduintoCCF misstates a crucial 
fact: that Mr. Helms admitted to the pornography allegation. Jj^^^m' wrote that the 15-6 
"also confirmed Mr. Helms put inappropria te and pornogra phic photos, videos, and audio files 
onto a classified government computer." 110 ^^^^^^^H further stated that Mr. Helms "admits 
in his statement to the investigating officer he knew his actions were wrong and yet continued 
even after being told to cease by the Battalion Information Management Office (IMO)." 111 



107 DoD 5200.1-R, "Information Security Program" (Jan. 1997) at C10. 1.3; AR 380-5, "Department of the Army 
Information Security Program" (Sept. 2000) at 10-3. 



108 



DoD IG Interview o 



21, 2010) at 15-16, 25-26, and 30. 



(Jan. 21, 2010) at 12, 22, and 28; and DoD IG Interview of 



DoD IG Interview o 
DoD IG Interview o 




(Jan. 21, 2010) at 17; M.S.P.B. testimony o: 
Dec. 10, 2009) at 32 ; DoD IG Interview o 
(July 14, 2008). 




(Oct. 29, 2009) at 61; 
Dec. 4, 2009) at 15-16; 



to CCF, Intent to Revoke Security Clearance (Nov. 25, 2008) at subparagraph l.b. 



Id. at subparagraph I.e. 
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In his sworn statement during the AR 15-6 investigation, Mr. Helms denied downloading 
and viewing pornography on a Government system and the AR 15-6 conclusions state in 
findings, "Mr. Helms . . . denies downloading pornography/^^ Moreover, Mr. Helms denied 
placing pornography on the system in his letter t0 ^^^^^^^| writing, "Let me state 
categorically, I neither created a 'rogue' connection or server as alleged or placed pornography 
of any kind on the hard drives that were reviewed for this inquiry." 113 

As part of this investigation, we arranged an independent forensic analysis of the 
evidence, conducted by Defense Criminal Investigative Service (DCIS). That examination 
served to reinforce Mr. Helms' denials regarding his placement of pornographic images on the 
Government computer 114 

DCIS confirmed the presence of the pornographic images and files, but determined that 
only two files were located in Mr. Helms' share profile. Additionally, they were located in the 
recycle directory, indicating they were deleted by Mr. Helms' account but not that they were 
placed on the computer by Mr. Helms' account. Another nine files were located in free space, 
not associated with any particular user, and the remaining 29 image files were located within the 
Fort Knox Field Office share folder. In short, the DCIS review determined that the pornography 
could have been loaded by any of those individuals who had access to the computer system. 
However, the CCA apparently did not consider this possibility and focused exclusively on 
Mr. Helms. 



Failure to comply with procedural requirements for timely filing 

Additionally, in evaluating the strength of the Agency's evidence supporting the 
recommendation to revoke Mr. Helms' security clearance, we reviewed whether the Agency 
followed its own regulations in pursuing the unfavorable personnel security determination. 



When revoking an employee's security clearance, the employee is entitled to procedural 
protections provided by statute as well as regulatory protection provided by AR 380-67. 115 In 
order for CCF to carry out its regulatory requirements pursuant to AR 380-67, the command 
must provide CCF with the derogatory information "immediately." 116 




and^^^^^^H,^^^^^^^^^H 902nd MI Group, admitted that Army 
regulations and INSCOM poncywer^otrolloweawieir recommending that the CCF revoke 

117 

Mr. Helms' security clearance. Mr. Helms' local access to classified information was initially 



112 AR 15-6 Investigation, Exhibit 14 and Exhibit 2 (Oct. 2008). 

113 Mr. Helms, Response to Notice of Indefinite Suspension (Oct. 24, 2008). 

114 MFR fromj^^^^^^ to DoD IG, Review of 902nd MI GP Computer Forensic Examination (Aug. 17, 2010). 

115 



116 



See Drumheller v. Dep't of the Army, 49 F.3d 1566, 1570 (Fed. Cir. 1995). 
DoD IG Interview of^HI| (Dec. 10, 2009) at 45-47. 



117 We note that complainant has appealed his indefinite suspension of employment to the M.S.P.B. In ruling on the 
merits of the indefinite suspension, Administrative Judge Howard J. Ansorge found that the Agency did comport 
with procedural requirements when suspending Mr. Helms based on the suspension of his access to classified 
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reported through JPAS on July 11, 2008. Subsequent follow-up reports were entered into JPAS 
on August 27^008^tnd October 28, 2008. T he AR 15-6 inv estigation was completed and 
signed by^m^^^f in October 2008, and^^^^^J signed a memorandum 
recommending that the CCF revoke Mr. Helms' security clearance on November 25, 2008. 
However, neither the results of the investigation nor the memorandum recommending revocation 
were sent to the CCF until 1 1 months later on October 28, 2009, after CRI inquired as to the 
status of Mr. Helms' clearance. 



The failure to expeditiously provide CCF with these documents violates the requirements 
ofAR380^57, which call for processing derogatory information "immediately" and "timely." 118 
testified that there "was an error somewhere. As soon as these things happen they 
should be put into [JPAS]." 119 The 902nd MIGroupLegalofficealso stated that the 
information should have been sent to CCF. ^HHH J^^^^^^H stated in an e-mail, 
should have signed the memo, sent it to CCF as that is who the me mo is 

120 



addressed to, and provided our office a copy of the signed memo." Additionally, 
indicated that it was only afterH learned of the DoD IG investigation that the final information 




was sent to CCF. 



121 



This deviation from Army regulation is significant because CCF holds a case in abeyance 
pending a command investigation. Since CCF never received a final notice that the AR 15-6 
investigation was complete, they never issued a letter of intent (LOI) as required by AR 380-67. 
By not immediately sending information to the CCF, Mr. Helms was deprived of the procedural 
protections the adjudicatory process provides. Although Mr. Helms was generally aware of the 
derogatory information, without a LOI, he was unable to formally respond to the CCF. 122 This 
omission persisted for 1 1 months, during which Mr. Helms was unable to work because his local 
access had been suspended, and unable to regain his clearance because CCF was not adjudicating 
his case. Mr. Helms was removed from federal employment in November 2009, shortly after the 
final incident was entered into JPAS. 123 Mr. Helms has yet to receive an LOI and has not had 
the opportunity to present the CCF with rebuttal evidence. 



information. The Administrative Judge's decision determined solely whether the Agency complied with statutory 
requirements related to his indefinite suspension from employment. We determined that while the Agency did 
comply with the statutory requirements, it did not comply with its own regulatory requirements. The Federal Circuit 
held in Drumheller that the Agency must abide by its own regulatory procedures in order to afford an employee due 
process. See Drumheller, 49 F.3d at 1570. 

118 AR 380-67 (Sept. 9, 1988), § 8-101-102. 

119 DoD IG Interview of H|^^| (Dec. 11, 2009) at 29. 

120 E-mail from J^^^J to DoD IG, Request for Clarification (Jan. 7, 2010, 2:53 p.m.). 

121 DoD IG Interview o^HHH (° ct 29 ' 2009 ) at 13 ~ 14 ' 

122 The Federal Circuit held in Drumheller v. Department of Army "[t]he regulations, 8-201(a)(2) and 8-201(b), give 
the employee against whom action is to be taken an opportunity to reply to the derogatory information in the LOI." 
Since Drumheller was provided this opportunity, the Federal Circuit held that her due process rights were not 
violated. However, unlike in Drumheller, the 902nd, whether intentionally or negligently, thwarted the adjudicatory 
process by failing to enter a final incident report into JPAS. 

123 Mr. Helms was removed from federal employment based on the recommendation of the 902nd MI Group 
Commander who cited misuse of government technology and failure to follow orders as the reason for removal. 
Lance, Notice of Decision to Remove (Nov. 6, 2009). 
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indicated that the 902nd MI Grou; 
the impression that they were sending the information to the CCF. 124 



inH testimony, 



Lega l office gave| 
^^^^^ provided 

conflicting testimony. Initially^ denied that J office was involved in forwarding the_ 
derogatory information. 125 However, when e-mail evidence indicated to the contrary, 
stated thatH office did play a role in forwarding the derogatory information. 126 According to 
Army regulation, the commander is ultimately responsible for forwarding the information. 



Existence and strength of a motive to retaliate on the part of Agency officials who were involved 
in the decision. 




testified that in deciding to recommend revocation of Mr. Helms' 
on advice and evidence presented by the 902nd MI Group, 
decision-makingwas based onHconversations with officials in the 902nd MI 

a Legal office. ^^^^^^^J testified thatH was instructed by the 902nd Group Legal 
to recommend the revocation of Mr. Helms' clearance. B also testified thatH initiall 
expressed concern that the decision was being made too fast. testified that 

attributed J concern to the fact that the 902nd MI Group was privy to more information than 
was. 128 Although^mmH was ultimately the official responsible for recommending the 
revocation, officials at the 902nd MI Group were involved in the decision. 129 Therefore, we 
analyze evidence of motive pertaining to all officials involved in the action. 



We found that the 902nd MI Group Command had motive to reprise against Mr. Helms. 
The evidence indicated that Mr. Helms' disclosures brought increased and arguably unwelcome 
scrutiny on the 902nd MI Group. m^^^^^^J an employee of the 308th MI Battalion, who 
was assigned by the 902nd MI Group as Mr. Helms' medical advocate, testified: 

[OIG Investigator]: Was there frustration more when J went to the press? 

Of course there was. It was very trying because now you're 
getting higher headquarters coming down to you saying why aren't you taking 
care of this guy? I mean the frustration was two-fold. One, why aren't we doing 




124 DoD IG Interview o 

125 DoD IG Interview o 

126 




(Dec. 12, 2009) at 25. 
(Dec. 10, 2009) at 48-49. 



Mr. Helms (Nov. 20, 



E-mail from^^^^^^^^H ^^^■ 902nd MI Group, Fort Meade, to| 

2008, 8:48 a.m.); and see also E-mailfrom^^^^M tol 

("Our office was facilitating the forwardingoftneaerogatory information that is required to be forwarded per the 
INSCOM polic y, as well as following the guidance from the OSJA INSCOM in advising our client, in this case 

127 i 



DoD IG Interview of 
'Id. 



(Dec. 11, 2009) at 23. 



' DoD IG Interview ol flHHH ( Dea 11 ' 2 009 ) at 23; s ee also DoD IG Interview of flHHV ^ Jan ' 21 ' 

201 0) at 20 -26; a nd seeaLsoDo^G Interview o4H|H (Ian. 21, 2010) at 18-19 (testmiSn^romf 

and^^^^^^^H confirm that the decision to revo^^Vlr^Hemis' clearance was initiated by the 902nd MI Group 
Command 
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enough for this guy? And two, why are we having higher headquarters coming 
and telling us how to do it. .. 130 

Additionally, Army officials were asked, on more than one occasion, to provide 
information to Congress or to higher level DoD officials on civilian deployments because of 
Mr. Helms' testimony. 131 For example, Mr. Helms' initial contact with SASC staff regarding his 
problems in obtaining medical treatment generated short-fused requests for information from the 
Office of the Under Secretary of Defense (OUSD) for Personnel and Readiness to the Army 
Deputy Chief of Staff for personnel (Gl) and Headquarters, INSCOM. According to e-mail 
communications at the time, Army headquarters personnel were tasked to provide SASC staff a 
briefing on the Helms case. 132 



Similarly, in June 2007 Mr. Helms' complaint to Ms. Bradshaw, Deputy Under Secretary 
of Defense for Civilian Personnel Policy, generated significant e-mail correspondence between 
OSD, Army headquarters, and INSCOM personnel. In one such e-mail an OSD official noted 
that "Mr. Helms is a unique case, given the nature of his injuries and his many attempts to draw 



attention to his situation in the last two years." 133 In another e-mail an Army official noted that 
the Department of Labor had given Mr. Helms' case priority attention, "because of the furor 
raised by all the letters to high-level people." 134 



Bravo Company, 308th MI Battalion, testified: 

There were times when the name of Mike Helms invoked a head 
back, rolling of the eyes at just the mention of his name. I know there 
are some that tried to help him. I know he got screwed at first, for the 
first maybe 18 months because I'm told the Army did not have 
something in place to handle this. But after probably 2 years of this, 
and again, I'm just repeating what I've been told from other people. 135 





Testimony from^ 

308th MI Battalion, established that Battalion and Group level 
officials attempted in the past to restrictMnHelms' interactions with the media. ^^^^^^1 
testified that was asked by theH^|^H^|, 308th MI Battalion, to make sure Mr. Helms 
did not go to the media. 



136 



DoD IG Interview o 



(Dec. 3, 2010) at 37. 



131 



E-mail from Mr. Helms to 



also e-mail from 

132 




SASC Staff Member, Recontact (Apr. 14, 2005, 7:31 a.m.); and see 
Helms Letter to HASC (Nov. 5, 2007, 12:27 p.m.). 



E-mail exchanges between HQ INSCOM, Army Gl, and OUSD(P&R) during the period May 12-20, 2005. 

133 E-mail of June 18, 2007 from Director, CPMS 

134 E-mail of June 19, 2007, from Army HQ to INSCOM HQ. 

135 DoD IG Interview o+H^^| (Oct. 14, 2009) at 34. 

136 DoD IG Interview of^^^^l (Dec. 30, 2009) at 27. 



For Official Uac Only 



b(B} 



CRI-HL 108920 



27 



may have said something to the fact of 
you need to make sure he's not reporting to the media, because I remember - 
whe ther it was reporting to the media or reporting to Congress - 1 basically told 
. . . 'you can't stop somebody from doing this.' 



[OIG Investigator] So J 

[Mr. Helms] from talking to the media? 



tried to ask you to prevent him 



Further, we believe a certain lack of objectivity of the AR 15-6 investigation suggests a 
retaliatory motive. In this case, the bona fides of the AR 15-6 investigation are relevant because 
the results of the investigation were the reason cited by the command when recommending the 
revocation of Mr. Helms' security clearance. We find it probative that the investigation 
primarily focused on Mr. Helms' action, and not on command officials who had knowledge of 
the server, in some cases, dati ng back 3 years. Members of the Fort Knox Field Office were not 
interviewed and, therefore, theH never learned that copies of office members' 

usernames and passwords were kept in the office safe where the staff could access them, 
testified: 



[DoD IG Investigator]: So I guess my question is how did you, how were you 
able to rule out all the other people in the office if. . . 

I wasn't investigating the other people in the office . . . 

[DoD IG Investigator]: Right. 

. . so if they did, in fact, misuse anything I wouldn't be privy to it 
because they weren't part of my investigation. 

[DoD IG Investigator] : No, understood. I guess my question is how did you 
come to the conclusion that it was, in fact, Mr. Helms versus someone else using 
the computer under his login name or . . . 

m^^^J Look, I didn't even entertain the possibility that, you know, he 
was, it was someone else. I investigated Mr. Helms. 



137 



Similar treatment as compared to other individuals who were non-whistleblowers, but otherwise 
similarly situated . 

Another factor to consider in the determination of whether the Agency has established, by 
clear and convincing evidence, that its actions were appropriate is whether the Agency's actions 
are similar to those taken against other employees who are not whistleblowers, but who are 
otherwise similarly situated. 



DoD IG Interview of 



| (Dec. 4, 2009) at 15-16. 
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We requested comparators from the 902nd MI Group. The 902nd MI Group was unable 
to provide a sufficient number of comparators. We then contacted INSCOM to broaden our 
sample size but were unable to obtain any additional examples. 138 Since an adequate sample 
could not be obtained, we determined that there is not enough evidence to reach a conclusion on 
the third comparator factor. If evidence does not exist as to one factor, a conclusion may be 
reached by weighing evidence presented on the first two factors. 139 




While t here was insu f ficient evidence to condu ct a comparator analyses, we find it 
noteworthy that^^m^ J^Kttj^^^^^^^^, was given a Letter of Reprimand, but no 
action was taken with respect to^Bsecurity clearance, following the AR15-6's conclusion that 
m failed to report credible derogatory information as required, and that^J knew of the Athena 
server over a 3 year period and failed to report it to the appropriate authorities. 140 
Letter of Repr imand cites a failure to follow rules and regulations over a 3-year perioc 

failure to follow rules and regulations should have been forwarded to CCF as 
derogatory information under adjudicatory guideline M (use of information technology systems), 
E (personal conduct), and AR 380-67, failure to follow regulations and questionable judgment. 141 

testified that su ch d erogatory information was not f orwarded because 

| took responsibility for factions and apologized^and j|| was not in the same 

position of responsibility as Mr. Helms 142 However, ^^^^^^H justification is appropriately 
considered by CCF as mitigating the derogatory information and does not justify the withholding 
of derogatory information from CFF 




143 



While action taken against^^^^^^H was performance-based, no performance based 
action was taken against Mr. Helinsformsestablishment of the unauthorized server and use of 
unauthorized software, other than counseling he received at the time his access was suspended. 
Instead, the command used the security clearance process as the means by which corrective 
action against Mr. Helms was taken. 



138 MRF from INSCOM to DoD IG, Response to Requests for Evidence Regarding Allegations Raised by 
Mr. Helms (Dec. 30, 2009). 

139 Carrv. Social Security Admin., 185 F.3d 1318,1323 (Fed. Cir. 1999); Hernandez v. Dep't of Homeland Sec, SF- 
1221-09-0191-W-l, 2009 M.S.P.B. LEXIS 2305 (April 23, 2009) (third factor did not apply because no evidence 
existed on that matter. However, the Administrative Judge held that that the Agency met its burden by establishing 
strong evidence in support of its actions and absence of motive.); Wadhwa v. Dep't of Veterans Affairs, 2009-3167, 
2009 U.S. App. LEXIS 25466 (Fed. Cir. 2009). (Where no evidence was introduced on the third Carr factor, the 
Appellate Court found that substantial evidence supported the Board's finding on the analysis of the first two 
factors.) 

14 °m^^^^^^m iVlcnioranduni of Reprimand for J|m^^^^| (Feb. 23, 2009). 

141 DoD 5200.2-R, "Personnel Security Program" (Jan 1987); AR 380-67, "Department of the Army Personnel 
Security Program Regulation" (Sept 1988). 

142 DoD IG Interview °f^^H (Jan. 21, 2010) at 14. 

143 DoD 5200.2-R, "Personnel Security Program" (Jan 1987); AR 380-67, "Department of the Army Personnel 
Security Program Regulation" (Sept 1988). 
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Suspension of Access to Classified Material 

We find that the Agency did provide clear and convincing evidence justifying the 
suspension of Mr. Helms' access. 

Strength of Evidence in Support of the Unfavorable Personnel Security Determination . 

stated reason for suspending Mr. Helms' access to classified information 

was derogatory information found during the Commanders' Inquiry. 144 The derogatory 
information was that Mr. Helms had installed and operated the unauthorized Athena server on 
the SIPRNet. 145 This information would fall within the adjudicatory guidelines for personal 
conduct where conduct for security clearance decision-making purposes pertain to conduct 
involving questionable judgment, lack of candor, dishonesty, or unwillingness to comply with 
rules and regulation^^Based on the information contained in the Commander's Inquiry, it was 
appropriate forj^^J^^^J to suspend Mr. Helms' access locally, pending the results of the 
AR 15-6 investigation. 



local access: 



testified that this wasH intention wher^B decided to suspend Mr. Helms' 



I was one of them that said, along with the battalion commander, let's 
slow down. Let's make sure, you know, he gets to say his side of the 
story before I make a determination... Let me just do local access 
because if I suspend more than local access the only people that can 
reinstate it is CCF... If I do local access and this 15-6 comes back 
where Mr. Helms doesn't fall, this is unsubstantiated, I can reinstate it 
immediately and there's no lag time. 147 

Credible derogatory information is sufficient to justify the suspension of access. 
INSCOM Policy #32 states: 

When a commander or security officer determines that they have 
evidence of credible derogatory information, the commander will 
ensure that such information is immediately reported to the CCF via 
the Incident Report link in JCAVS (JPAS). Concurrently, 
commanders will determine, based on the nature and severity of the 
information, whether or not suspension of the employee's access to 
classified information is warranted, and, if so, whether such 
suspension will be informal (local) or formal. Formal suspension of 




Counseling for Derogatory information for Mike Helms, (Aug. 27, 2008). 



Review of the Fort Knox Field Office Unauthorized Network Configuration, Unauthorized 
Domain, and Unauthorized Use of Unlicensed Software (June 6, 2008). 

146 Personnel Security Program, DoD Regulation 5200 .2-R. 

147 OIG TestimonvH^^^^^HB (Dec. 1 1, 2009) at 35-36. 
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suspension of 



Mr. Helms' access, pending further investigation, was appropriate. 

Existence and strength of a motive to retaliate on the part of Agency officials who were involved 
in the decision . 

Because the suspension of access pending adjudication of derogatory information is 
authorized by regulation, we find little basis to explore motivation for the decision in view of the 
circumstances of this case. That is, given the nature and severity of the actions detailed in the 
Commander's Inquiry, it was prudent to suspend Mr. Helms' access pending resolution of 
security issues and we found that basic procedural requirements were followed. As outlined 
above, however, the procedural irregularities that attended the more serious decision to 
recommend revocation of a clearance undermine the credibility of that decision. 

Similar treatment as compared to other individuals who were non-whistleblowers, but otherwise 
similarly situated. 

We did not obtain sufficient comparators and we rest our conclusion here on analysis 

above. 



We did not substantiate the allegation that Mr. Helms' access to classified information 
was suspended in reprisal for making multiple disclosures. 

We substantiated the allegation that the recommendation to revoke Mr. Helms' clearance 
was in reprisal for making protected disclosures. 



We recommend that the 902nd MI Group consider taking appropriate remedial action 
with regard to Mr. Helms. 



INSCOM Policy #32 at 7. 

AR 380-67, 8-102(Suspension); INSCOM Policy #32 at 7. 



CONCLUSION 



RECOMMENDATION 
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